Here’s a number that should make any small-firm owner sit up: according to Clio’s 2026 Legal Trends data, 79% of legal professionals now use AI — but roughly 55–57% of solo and small firms have no written AI policy at all. No document. Nothing that says which tools are okay, what client information can go in, or who checks the output before it leaves the building.
That’s not a paperwork problem. It’s the exact gap the courts spent 2026 punishing. The lawyers who got hit with five- and six-figure sanctions for AI-fabricated citations almost all worked somewhere with no policy and no verification habit. One small-firm attorney summed up the lesson after watching colleagues get sanctioned: policies live in a document, but verification has to live in the workflow. You need both — and the document is the easy part. You can have it done before lunch.
This post hands you that document. Copy it, fill in the blanks, and you’ve closed the single biggest AI liability gap most small firms have.
Why a one-page policy beats a 16-page one
There’s a temptation, especially if you’ve read ABA Formal Opinion 512, to write something exhaustive. Don’t. A 16-page AI policy that nobody reads protects no one. The firms that stay safe have a short, blunt document everyone actually internalizes.
A good small-firm AI policy only has to answer three questions clearly:
- What can never go into a consumer AI tool? (Confidentiality.)
- What has to happen before AI output leaves the firm? (Verification.)
- Do we tell clients we use it? (Disclosure.)
Everything else is detail. Those three are the load-bearing walls, and they map directly onto the ethics rules — confidentiality (Model Rule 1.6), competence and candor (Rules 1.1 and 3.3), and communication (Rule 1.4) — that ABA 512 says already apply to you whether you’ve written them down or not.
The template (copy this)
Paste this into a blank document, replace the bracketed parts, and circulate it to everyone at the firm — attorneys, paralegals, and staff. That last part matters: under the supervision rules (5.1 and 5.3), you’re responsible for how your team uses these tools, not just yourself.
[FIRM NAME] — ARTIFICIAL INTELLIGENCE USE POLICY
Effective [DATE] · Applies to: all attorneys, paralegals, and staff
1. WHAT WE USE AI FOR
AI tools (ChatGPT, Claude, and approved legal platforms) may be used to
DRAFT and SUMMARIZE: intake summaries, first drafts of letters and
internal memos, plain-English client explanations, and outlines.
AI is a drafting assistant. It is never the final authority on the law.
2. CONFIDENTIALITY — WHAT NEVER GOES IN
Do NOT enter into any consumer/public AI tool:
- Client names or any detail that could identify a client or matter
- Privileged communications, full case files, or settlement figures
- Anything covered by a protective order or NDA
When in doubt, de-identify first (replace names with "the client,"
remove dates and locations) OR use only [APPROVED ENTERPRISE TOOL]
that the firm has a written data agreement with.
3. VERIFICATION — BEFORE ANYTHING LEAVES THE FIRM
For any document that cites law or states facts:
- Open and read every case/statute the AI references in a real
database. If it can't be found, it does not exist — remove it.
- Confirm every quotation appears word-for-word in the source.
- The signing attorney certifies accuracy. "The AI wrote it" is
never an excuse.
4. CLIENT DISCLOSURE
We disclose material AI use to clients when it affects how, how fast,
or at what cost their work is done. We do not bill clients for time
spent learning AI tools.
5. WHO OWNS THIS
Questions or new tools go through [NAME/ROLE] before use.
This policy is reviewed every [6/12] months.
Signed: ____________________ Date: __________
That’s it. Five sections, one page. The bracketed fields take about ten minutes to fill in, and the signature line turns it from a suggestion into a commitment your whole team has acknowledged.
How to actually roll it out
A policy in a drawer is the same as no policy. Three steps make it real:
- Send it once, get a signature. Email it to everyone, ask them to reply or sign. Now it’s documented that the firm has a standard — which matters a lot if a question ever comes up.
- Name your tools. “Approved AI tools” is vague. Write down the specific ones: the free ChatGPT for low-risk drafting with de-identified inputs, plus whatever enterprise or legal-specific platform you’ve vetted for anything touching real client data.
- Build the verification step into review. The policy says “verify before filing.” Make that a literal box on your filing checklist, so it happens even on a deadline at 6 p.m. — which is exactly when the sanctioned lawyers cut the corner.
What this means for you
Solo, no staff: You’re the whole policy. The value here is forcing yourself to pre-decide the confidentiality and verification rules now, calmly, instead of improvising them under deadline pressure later.
2–10 lawyers: This is urgent. Your exposure is the well-meaning team member who pastes a client matter into a free tool to save five minutes. The signed policy plus a named approved-tools list is your protection.
Office manager / paralegal lead: You can own this rollout end to end. Adopting it doesn’t require a partners’ meeting — it requires one email and a checklist edit.
What a policy can’t do
- It can’t verify cases for you. The document sets the rule; a human still has to open every citation. The policy makes the habit official — it doesn’t perform it.
- It can’t make an unvetted tool safe. Writing “approved tools” means nothing until you’ve actually read a tool’s privacy terms and, for anything touching client data, signed a data agreement.
- It can’t replace judgment on close calls. Some matters are sensitive enough that the answer is “no AI on this one.” The policy should make that an easy call to make, not a hard one.
- It isn’t legal advice for your jurisdiction. State bars vary; treat this as a strong starting point and check your own rules of professional conduct.
The bottom line
The gap between “uses AI” and “has a written AI policy” is where 2026’s sanctions live. Closing it is genuinely a ten-minute job — copy the template, fill in five blanks, get a signature, add one line to your filing checklist. That’s a remarkably cheap insurance policy against a six-figure mistake.
Want the policy plus the safe day-to-day workflow it’s meant to protect? ChatGPT Without the Liability builds the whole thing — confidentiality, verification, and the ethics rules behind them — into a workflow you can run on real matters. And AI for Lawyers (Practical) covers the drafting side the policy makes safe.
